Warning Signs About Another Giant Bitcoin Exchange

SAN FRANCISCO — As the price of Bitcoin has soared, the virtual currency has edged toward the mainstream.

Square, the fast-growing payments company run by the Twitter co-founder Jack Dorsey, has begun selling Bitcoins to ordinary consumers, and the Chicago Mercantile Exchange will soon allow banks to trade on the value of Bitcoin.

But if you want to see where the price of Bitcoin is actually determined in round-the-clock bidding, you have to go to a number of unregulated exchanges that often fly in the face of American and European laws.

These days, no exchange is bigger than Bitfinex, an opaque operation that provides no information on its website about where it is or who operates the company.

Bitfinex, which is officially incorporated in the British Virgin Islands, has been fined by regulators in the United States and cut off by American banks, and it has lost millions of dollars of customer money in two separate hackings, leading critics to question whether it even has the money it claims to hold.

In the latest blow, on Tuesday, an alternative virtual currency that is owned and operated by the same people as Bitfinex, known as Tether, announced that it had been hacked and lost around $30 million worth of digital tokens.

None of that has been enough to stop customers from pumping billions of dollars worth of virtual currency trades through Bitfinex in recent weeks — on some days, the exchange claimed to be doing more trades, by dollar value, than some stock exchanges in the United States.

Even many people who believe in virtual currencies worry that the mixture of loose controls and booming trading at the world’s largest exchange is likely to cause trouble for all the investors piling into virtual currencies, even those who don’t go near Bitfinex.

“I’m worried about the systemic risk that this centralized company poses, and I’m worried that if they go down, they will take down the space with them,” said Emin Gün Sirer, a computer science professor at Cornell University, who has a track record of successfully predicting problems in the growing virtual currency industry.

The chief executive of Bitfinex and Tether, Jan Ludovicus van der Velde, said in an email on Tuesday that “the financial position of the company has never been stronger.”

Concerns over virtual currency exchanges are nothing new. The first and largest Bitcoin exchange, Mt. Gox, collapsed in 2014 after losing $500 million of customer money to hackers.

This year, law enforcement took down another large Bitcoin exchange, BTC-E, which was accused of being a way station for many of the Bitcoin flowing through online black markets and ransomware attacks.

Regulators in the United States and a few other countries have tried to tame the business, and the largest exchanges in the United States and Japan are now under official oversight.

Those regulated exchanges, though, are dwarfed by unregulated ones like Bitfinex and several that have popped up in South Korea, where regulators have been slow to act.

The liquid nature of the Bitcoin markets, flowing around national borders and laws, is a product of the virtual currency’s unusual structure. Bitcoin is stored and moved through a decentralized network of computers that are not under the control of any single company or government.

This structure means that the virtual currency continues to be an easy target for people who want to manipulate its price or use it to launder money.

“Unregulated, unregistered exchanges are a very big concern for the industry and the community broadly,” said Kathryn Haun, a former federal prosecutor who is on the board of the American virtual currency company Coinbase.

The most frequent face of Bitfinex is its chief strategy officer, Phil Potter. Mr. Potter worked for Morgan Stanley in New York in the 1990s but lost his job after bragging at length in The New York Times about his $3,500 Rolex, his opulent lifestyle and his aggressive tactics for making money.

Mr. Potter, 45, runs Bitfinex alongside Mr. Van der Velde, a Dutch-speaking man living in Hong Kong, and Giancarlo Devasini, an Italian man who lives on the French Riviera, according to company filings in Hong Kong.

The company lost 1,500 Bitcoin, worth around $400,000, to a hacker in 2015. But the most damaging incident happened in August 2016 when a thief got almost 120,000 Bitcoin, worth around $75 million at the time.

The company spread out the losses to all customers — even those who were not holding Bitcoin at the time of the hacking — by forcing customers to take a 36 percent haircut or loss on any money at the exchange.

The lack of detail that Bitfinex provided about the hacking drove away some large customers like Arthur Hayes, the founder of Bitmex, a Hong Kong-based virtual currency exchange.

“There are so many questions about them,” Mr. Hayes said. “All of this could be easily rectified by just showing all the figures.”

Mr. van der Velde said the company had “been as public and transparent as possible about the security incident in August 2016 given the ongoing criminal investigations.”

Banks have also been put off by Bitfinex’s operations. Wells Fargo said this year that it would no longer move money from Bitfinex accounts. Shortly after, Bitfinex said its main banks in Taiwan were shutting it off. Since then, it has moved between a series of banks in other countries, without telling customers where the exchange’s money is stored.

But nothing has drawn more criticism than the operation of Tether, a virtual currency that is supposed to be tied — or tethered — to the value of a dollar.

Customers can buy Tether coins on Bitfinex and then transfer them to other virtual currency exchanges, providing a way to move dollars between countries without going through banks. Tether has also become a very popular way to buy Bitcoin. In recent weeks, a few hundred millions dollars’ worth of Tether has changed hands on a daily basis across several exchanges, according to data on CoinMarketCap.com.

Tether and Bitfinex have insisted that the two operations are separate. But leaked documents known as the Paradise Papers, which were made public this month, show that Appleby, an offshore law firm, helped Mr. Potter and Mr. Devasini, the Bitfinex operators, set up Tether in the British Virgin Islands in late 2014.

One persistent online critic, going by the screen name Bitfinex’ed, has written several very detailed essays on Medium arguing that Bitfinex appears to be creating Tether coins out of thin air and then using them to buy Bitcoin and push the price up.

Tether and Bitfinex have countered this criticism in statements on the companies’ websites and promised that every Tether is backed up by a dollar sitting in a bank account. In September, the companies provided an accounting document intended to prove that Tether is financed with real money.

Lewis Cohen, a lawyer at the law firm Hogan Lovells who advises many virtual currency projects, said the document, because of the careful way it was phrased, did not prove that the Tether coins are backed by dollars.

Even if they are, he said, Tether and Bitfinex appear to be violating laws in the United States and Europe that govern investments like Tether, which has qualities very similar to a money market mutual fund.

“There are a long list of reasons that you don’t want to deal with them,” Mr. Cohen said of Tether.

On Tuesday, Tether announced that an “external attacker” had taken $30 million worth of Tether from the company’s online wallets. The company said it was working to recover the coins.